Two Truths and a Lie: Halloween Cyber Myths
The scariest things in security aren't hackers in hoodies. They're the myths people still believe. Ten rounds, three statements each, one lie hiding in every round. Find it.
Each myth, where it came from, and what CompTIA expects you to know.
Why these myths stick around
Almost every security myth starts as something half true. Private browsing really does wipe your local history. The padlock really does mean something. A deleted file really does vanish from your screen. People remember the true half and fill in the rest with what they hope is true. CompTIA writes wrong answers the same way: plausible, comfortable, and missing the part that matters. Here's the missing half of each one.
Where it comes from
Browsers gave the feature names like "Incognito" and used a spy icon. The name promises more than the feature does.
What's actually true
Private mode only changes what's saved on your device: history, cookies, cached files, and form entries are discarded when you close the window. Downloads and bookmarks stay. Your Internet Protocol (IP) address, your internet provider, the network admin at work, and every site you visit still see you exactly as before. It also does nothing against malware or keyloggers already on the machine.
What to do instead
Use private mode for what it's good at: a shared computer, or signing into a second account. If you need to hide traffic from the local network, that's a Virtual Private Network (VPN), which moves your trust to the VPN provider. Secure Domain Name System (DNS) (DNS over Hypertext Transfer Protocol Secure (HTTPS)) hides your lookups from the local network too.
Exam angle
A+ Core 2 2.11 lists private-browsing mode, clearing browsing data and cache, secure DNS, and proxy settings. Expect a question where a user thinks private mode protected them. It didn't.
Where it comes from
For years Windows had most of the market, so most malware targeted Windows. macOS and iOS also ship with real built-in protections like app signing, Gatekeeper, and sandboxing.
What's actually true
Fewer attacks isn't zero. Adware, password stealers, and ransomware all exist for macOS, and malicious apps have repeatedly been removed from official app stores after slipping past review. Built-in protection lowers risk. It doesn't remove it, especially once a user approves an install or a phone is jailbroken.
What to do instead
Same playbook on every platform: keep the Operating System (OS) and apps updated, install from trusted sources, don't sideload or jailbreak, and use endpoint protection where the organization requires it.
Exam angle
A+ Core 2 1.8 lists antivirus and updates as macOS best practices, right next to Rapid Security Response. Core 2 3.3 covers jailbreaks, sideloading, and unofficial app stores as mobile security issues.
Where it comes from
Early government password guidance recommended complexity rules and regular rotation, and corporate policies copied it for decades.
What's actually true
Forced rotation trains people into predictable patterns: Fall2026! becomes Winter2026!. Current National Institute of Standards and Technology (NIST) guidance (SP 800-63B) recommends long passwords, checking new passwords against known-breached lists, and changing passwords only when there's a sign of compromise. Length beats clever symbols, and Multifactor Authentication (MFA) beats all of it.
What to do instead
Long, unique passphrases for every account, stored in a password manager, with MFA turned on everywhere it's offered. Passwordless options like passkeys go a step further.
Exam angle
Careful here. A+ Core 2 2.7 still lists length, character types, uniqueness, complexity, and expiration as password considerations, and Security+ 4.6 includes age and expiration. Know them as policy settings you can configure. Just don't pick "rotate more often" as the best fix when MFA or length is an option.
Where it comes from
People use "virus" for everything, and the malware names blur together.
What's actually true
The names describe how the malware gets in and spreads:
What to do instead
Match the defense to the behavior: user education and allow lists for Trojans, patching and segmentation for worms, boot-time scans or a full reinstall for rootkits.
Exam angle
A+ Core 2 2.4 and Security+ 2.4 both give you a behavior and ask for the name. "Spread across the network with no user action" is always a worm.
Where it comes from
For years browsers labeled HTTPS sites "Secure," and security training told people to "look for the padlock."
What's actually true
The padlock means the connection is encrypted and the certificate matches the domain name. It says nothing about who runs the site. Basic certificates are free and issued automatically, so phishing sites use HTTPS too. The misunderstanding was common enough that Chrome replaced the padlock with a neutral settings icon in 2023.
What to do instead
Check the actual domain, letter by letter. Be suspicious of how you got there: a link in an unexpected email is the warning sign, not the missing padlock. Never click through certificate warnings.
Exam angle
A+ Core 2 2.11 covers valid certificates and secure connections, and 3.4 lists certificate warnings as a browser symptom. Security+ 2.2 names typosquatting and brand impersonation.
Where it comes from
The file disappears from the folder, so it feels gone.
What's actually true
Deleting a file usually just marks its space as available. The data stays on the drive until something overwrites it, and recovery tools can often bring it back. Emptying the Recycle Bin and a quick format work the same way. Solid-State Drives (SSDs) complicate recovery, but you shouldn't count on that either.
What to do instead
Match the method to the goal. Reusing a drive: a proper wipe or secure-erase tool. Retiring it: physical destruction such as drilling, shredding, or incineration. Degaussing works on magnetic hard drives, not SSDs. Using a vendor? Get a certificate of destruction.
Exam angle
A+ Core 2 2.9 lists all of it: erasing/wiping, low-level vs. standard formatting, drilling, shredding, degaussing, incineration, third-party vendors, and certificates of destruction. Security+ 4.2 covers sanitization and destruction in the asset lifecycle.
Where it comes from
Attachments are a familiar malware route, so people may only look for a suspicious file.
What's actually true
A fake login link, QR code, phone call, or reply requesting credentials can work without an attachment. The deception is the request and destination, not the file format.
What to do instead
Open the service through a known bookmark or app and verify unusual requests with a trusted contact method. Do not use contact details supplied by the suspicious message.
Exam angle
Security+ 2.2: recognize brand impersonation, phishing and misleading URLs. A message without an attachment still needs verification.
Where it comes from
Two steps can look like two factors when both screens ask for a secret.
What's actually true
Passwords and PINs are both knowledge factors. MFA combines distinct types: something you know, have, or are. A password plus a security key or fingerprint can meet that distinction.
What to do instead
Choose independent factor types and enroll a secure recovery method. Prefer phishing-resistant methods where available; two-factor login does not make every session immune to compromise.
Exam angle
Security+ 4.6: classify factors before counting them. Password plus PIN remains one factor type even when asked on separate screens.
Where it comes from
A clean scan feels like proof that the whole system is secure.
What's actually true
Anti-malware detects or blocks threats; patching fixes vulnerable code. A clean scan cannot establish that an application has no exploitable weakness. Both controls have a role.
What to do instead
Install supported vendor updates through the approved process, test critical applications, and verify deployment. Keep anti-malware current alongside patching rather than treating either as a substitute.
Exam angle
A+ Core 2 hardening and Security+ vulnerability management: choose the fix for the weakness. A missing security patch calls for patching, not only a signature update.
Where it comes from
Backups can restore encrypted files, which can make recovery feel like the entire incident is solved.
What's actually true
Offline copies reduce the chance ransomware can encrypt the recovery copy. They do not stop an attacker stealing production data before encryption or threatening to publish it.
What to do instead
Keep protected backups and test restoration. During an incident, contain the intrusion, investigate possible exfiltration, and coordinate reporting while preparing a clean recovery.
Exam angle
Security+ resilience and incident response: distinguish availability from confidentiality. A successful restore addresses lost access; potential data theft still requires investigation.
How to beat a myth question on test day
- Watch for absolute words. "Always," "never," "completely," and "the single best" usually mark the comfortable wrong answer.
- Ask where the protection applies. Private browsing is local. HTTPS covers the connection, not the site's owner. Deleting is a file system change, not a wipe.
- Pick the most complete fix. When MFA, length, or a proper wipe is an option, it beats the half-measure.
- Name the behavior, then the threat. Spreads alone: worm. Disguised install: Trojan. Hides itself: rootkit.
Watch it
Want the myths busted on video too? These free explainers cover the same threats. They open on YouTube in a new tab.
Where this shows up on your exam
Antivirus and updates as macOS best practices; jailbreaks, sideloading, and unofficial app stores.
Virus vs. worm vs. Trojan vs. rootkit, and the tools to detect and remove them.
Password length, complexity, uniqueness, and expiration as configurable settings.
Wiping vs. formatting vs. physical destruction, and certificates of destruction.
Private browsing, secure DNS, valid certificates, and certificate warnings.
Typosquatting and brand impersonation; password best practices, managers, and passwordless.
Brett went from food service to Information Technology (IT) in 2020 and earned his certifications from scratch. He builds BB Tech Tools to close a gap every IT learner hits: knowing the concepts but freezing on Performance-Based Questions (PBQs).